{"action":"created","issue":{"url":"https://api.github.com/repos/tootsuite/documentation/issues/204","repository_url":"https://api.github.com/repos/tootsuite/documentation","labels_url":"https://api.github.com/repos/tootsuite/documentation/issues/204/labels{/name}","comments_url":"https://api.github.com/repos/tootsuite/documentation/issues/204/comments","events_url":"https://api.github.com/repos/tootsuite/documentation/issues/204/events","html_url":"https://github.com/tootsuite/documentation/pull/204","id":226182674,"number":204,"title":"Add default CSP (take 2)","user":{"login":"nolanlawson","id":283842,"avatar_url":"https://avatars3.githubusercontent.com/u/283842?v=3","gravatar_id":"","url":"https://api.github.com/users/nolanlawson","html_url":"https://github.com/nolanlawson","followers_url":"https://api.github.com/users/nolanlawson/followers","following_url":"https://api.github.com/users/nolanlawson/following{/other_user}","gists_url":"https://api.github.com/users/nolanlawson/gists{/gist_id}","starred_url":"https://api.github.com/users/nolanlawson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nolanlawson/subscriptions","organizations_url":"https://api.github.com/users/nolanlawson/orgs","repos_url":"https://api.github.com/users/nolanlawson/repos","events_url":"https://api.github.com/users/nolanlawson/events{/privacy}","received_events_url":"https://api.github.com/users/nolanlawson/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2017-05-04T05:44:35Z","updated_at":"2017-05-14T21:23:19Z","closed_at":"2017-05-08T18:16:50Z","pull_request":{"url":"https://api.github.com/repos/tootsuite/documentation/pulls/204","html_url":"https://github.com/tootsuite/documentation/pull/204","diff_url":"https://github.com/tootsuite/documentation/pull/204.diff","patch_url":"https://github.com/tootsuite/documentation/pull/204.patch"},"body":"Follow up to https://github.com/tootsuite/documentation/pull/127, with the goal of addressing the concerns in https://github.com/tootsuite/documentation/pull/127#issuecomment-297661478.\r\n\r\nThis is what we're currently running on toot.cafe and doesn't seem to cause any issues. Scores an A- on Mozilla Observatory – AFAICT it's not possible to score A+ because removing `script-src 'unsafe-inline'` will result in a console error in Firefox.\r\n\r\nI think it's important to at least have a default recommended CSP because a lot of instances seem to be rolling their own, which can cause compat issues, e.g. there was discussion [on Matrix](https://matrix.to/#/!VMUpuubSCTxMbZkuZa:cybre.space/$1493869579852685YXIjI:matrix.org) about mst3k federation being broken due to a bad CSP."},"comment":{"url":"https://api.github.com/repos/tootsuite/documentation/issues/comments/301340940","html_url":"https://github.com/tootsuite/documentation/pull/204#issuecomment-301340940","issue_url":"https://api.github.com/repos/tootsuite/documentation/issues/204","id":301340940,"user":{"login":"fwenzel","id":87232,"avatar_url":"https://avatars3.githubusercontent.com/u/87232?v=3","gravatar_id":"","url":"https://api.github.com/users/fwenzel","html_url":"https://github.com/fwenzel","followers_url":"https://api.github.com/users/fwenzel/followers","following_url":"https://api.github.com/users/fwenzel/following{/other_user}","gists_url":"https://api.github.com/users/fwenzel/gists{/gist_id}","starred_url":"https://api.github.com/users/fwenzel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fwenzel/subscriptions","organizations_url":"https://api.github.com/users/fwenzel/orgs","repos_url":"https://api.github.com/users/fwenzel/repos","events_url":"https://api.github.com/users/fwenzel/events{/privacy}","received_events_url":"https://api.github.com/users/fwenzel/received_events","type":"User","site_admin":false},"created_at":"2017-05-14T21:23:19Z","updated_at":"2017-05-14T21:23:19Z","body":"@nolanlawson agreed on the referrer policy. I do like origin-when-cross-origin, so long as that works with both Chrome and Firefox? Anyway, new PR time."}}
{"actor":{"display_login":"fwenzel"}}